]>
git.proxmox.com Git - mirror_ovs.git/blob - lib/pcap-file.c
2 * Copyright (c) 2009, 2010, 2012, 2013, 2014, 2015 Nicira, Inc.
4 * Licensed under the Apache License, Version 2.0 (the "License");
5 * you may not use this file except in compliance with the License.
6 * You may obtain a copy of the License at:
8 * http://www.apache.org/licenses/LICENSE-2.0
10 * Unless required by applicable law or agreed to in writing, software
11 * distributed under the License is distributed on an "AS IS" BASIS,
12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13 * See the License for the specific language governing permissions and
14 * limitations under the License.
18 #include "pcap-file.h"
24 #include "byte-order.h"
26 #include "dp-packet.h"
28 #include "openvswitch/hmap.h"
31 #include "unaligned.h"
33 #include "openvswitch/vlog.h"
35 VLOG_DEFINE_THIS_MODULE(pcap
);
38 uint32_t magic_number
; /* magic number */
39 uint16_t version_major
; /* major version number */
40 uint16_t version_minor
; /* minor version number */
41 int32_t thiszone
; /* GMT to local correction */
42 uint32_t sigfigs
; /* accuracy of timestamps */
43 uint32_t snaplen
; /* max length of captured packets */
44 uint32_t network
; /* data link type */
46 BUILD_ASSERT_DECL(sizeof(struct pcap_hdr
) == 24);
49 uint32_t ts_sec
; /* timestamp seconds */
50 uint32_t ts_usec
; /* timestamp microseconds */
51 uint32_t incl_len
; /* number of octets of packet saved in file */
52 uint32_t orig_len
; /* actual length of packet */
54 BUILD_ASSERT_DECL(sizeof(struct pcaprec_hdr
) == 16);
57 ovs_pcap_open(const char *file_name
, const char *mode
)
63 ovs_assert(!strcmp(mode
, "rb") ||
64 !strcmp(mode
, "wb") ||
67 file
= fopen(file_name
, mode
);
69 VLOG_WARN("%s: failed to open pcap file for %s (%s)", file_name
,
70 (mode
[0] == 'r' ? "reading"
71 : mode
[0] == 'w' ? "writing"
79 error
= ovs_pcap_read_header(file
);
88 ovs_pcap_write_header(file
);
92 if (!fstat(fileno(file
), &s
) && !s
.st_size
) {
93 ovs_pcap_write_header(file
);
104 ovs_pcap_read_header(FILE *file
)
107 if (fread(&ph
, sizeof ph
, 1, file
) != 1) {
108 int error
= ferror(file
) ? errno
: EOF
;
109 VLOG_WARN("failed to read pcap header: %s", ovs_retval_to_string(error
));
112 if (ph
.magic_number
!= 0xa1b2c3d4 && ph
.magic_number
!= 0xd4c3b2a1) {
113 VLOG_WARN("bad magic 0x%08"PRIx32
" reading pcap file "
114 "(expected 0xa1b2c3d4 or 0xd4c3b2a1)", ph
.magic_number
);
121 ovs_pcap_write_header(FILE *file
)
123 /* The pcap reader is responsible for figuring out endianness based on the
124 * magic number, so the lack of htonX calls here is intentional. */
126 ph
.magic_number
= 0xa1b2c3d4;
127 ph
.version_major
= 2;
128 ph
.version_minor
= 4;
132 ph
.network
= 1; /* Ethernet */
133 ignore(fwrite(&ph
, sizeof ph
, 1, file
));
138 ovs_pcap_read(FILE *file
, struct dp_packet
**bufp
, long long int *when
)
140 struct pcaprec_hdr prh
;
141 struct dp_packet
*buf
;
149 if (fread(&prh
, sizeof prh
, 1, file
) != 1) {
152 VLOG_WARN("failed to read pcap record header: %s",
153 ovs_retval_to_string(error
));
160 /* Calculate length. */
164 len
= uint32_byteswap(len
);
166 VLOG_WARN("bad packet length %"PRIuSIZE
" or %"PRIu32
168 len
, uint32_byteswap(len
));
173 /* Calculate time. */
175 uint32_t ts_sec
= swap
? uint32_byteswap(prh
.ts_sec
) : prh
.ts_sec
;
176 uint32_t ts_usec
= swap
? uint32_byteswap(prh
.ts_usec
) : prh
.ts_usec
;
177 *when
= ts_sec
* 1000LL + ts_usec
/ 1000;
181 buf
= dp_packet_new(len
);
182 data
= dp_packet_put_uninit(buf
, len
);
183 if (fread(data
, len
, 1, file
) != 1) {
184 int error
= ferror(file
) ? errno
: EOF
;
185 VLOG_WARN("failed to read pcap packet: %s",
186 ovs_retval_to_string(error
));
187 dp_packet_delete(buf
);
195 ovs_pcap_write(FILE *file
, struct dp_packet
*buf
)
197 struct pcaprec_hdr prh
;
201 prh
.ts_sec
= tv
.tv_sec
;
202 prh
.ts_usec
= tv
.tv_usec
;
203 prh
.incl_len
= dp_packet_size(buf
);
204 prh
.orig_len
= dp_packet_size(buf
);
205 ignore(fwrite(&prh
, sizeof prh
, 1, file
));
206 ignore(fwrite(dp_packet_data(buf
), dp_packet_size(buf
), 1, file
));
211 ovs_be32 nw_src
, nw_dst
;
212 ovs_be16 tp_src
, tp_dst
;
216 struct hmap_node hmap_node
;
219 struct dp_packet payload
;
227 tcp_stream_destroy(struct tcp_reader
*r
, struct tcp_stream
*stream
)
229 hmap_remove(&r
->streams
, &stream
->hmap_node
);
230 dp_packet_uninit(&stream
->payload
);
234 /* Returns a new data structure for extracting TCP stream data from an
235 * Ethernet packet capture */
237 tcp_reader_open(void)
239 struct tcp_reader
*r
;
241 r
= xmalloc(sizeof *r
);
242 hmap_init(&r
->streams
);
246 /* Closes and frees 'r'. */
248 tcp_reader_close(struct tcp_reader
*r
)
250 struct tcp_stream
*stream
, *next_stream
;
252 HMAP_FOR_EACH_SAFE (stream
, next_stream
, hmap_node
, &r
->streams
) {
253 tcp_stream_destroy(r
, stream
);
255 hmap_destroy(&r
->streams
);
259 static struct tcp_stream
*
260 tcp_stream_lookup(struct tcp_reader
*r
,
261 const struct tcp_key
*key
, uint32_t hash
)
263 struct tcp_stream
*stream
;
265 HMAP_FOR_EACH_WITH_HASH (stream
, hmap_node
, hash
, &r
->streams
) {
266 if (!memcmp(&stream
->key
, key
, sizeof *key
)) {
273 static struct tcp_stream
*
274 tcp_stream_new(struct tcp_reader
*r
, const struct tcp_key
*key
, uint32_t hash
)
276 struct tcp_stream
*stream
;
278 stream
= xmalloc(sizeof *stream
);
279 hmap_insert(&r
->streams
, &stream
->hmap_node
, hash
);
280 memcpy(&stream
->key
, key
, sizeof *key
);
282 dp_packet_init(&stream
->payload
, 2048);
286 /* Processes 'packet' through TCP reader 'r'. The caller must have already
287 * extracted the packet's headers into 'flow', using flow_extract().
289 * If 'packet' is a TCP packet, then the reader attempts to reconstruct the
290 * data stream. If successful, it returns an dp_packet that represents the data
291 * stream so far. The caller may examine the data in the dp_packet and pull off
292 * any data that it has fully processed. The remaining data that the caller
293 * does not pull off will be presented again in future calls if more data
294 * arrives in the stream.
296 * Returns null if 'packet' doesn't add new data to a TCP stream. */
298 tcp_reader_run(struct tcp_reader
*r
, const struct flow
*flow
,
299 const struct dp_packet
*packet
)
301 struct tcp_stream
*stream
;
302 struct tcp_header
*tcp
;
303 struct dp_packet
*payload
;
304 unsigned int l7_length
;
309 const char *l7
= dp_packet_get_tcp_payload(packet
);
311 if (flow
->dl_type
!= htons(ETH_TYPE_IP
)
312 || flow
->nw_proto
!= IPPROTO_TCP
316 tcp
= dp_packet_l4(packet
);
317 flags
= TCP_FLAGS(tcp
->tcp_ctl
);
318 l7_length
= (char *) dp_packet_tail(packet
) - l7
;
319 seq
= ntohl(get_16aligned_be32(&tcp
->tcp_seq
));
322 memset(&key
, 0, sizeof key
);
323 key
.nw_src
= flow
->nw_src
;
324 key
.nw_dst
= flow
->nw_dst
;
325 key
.tp_src
= flow
->tp_src
;
326 key
.tp_dst
= flow
->tp_dst
;
327 hash
= hash_bytes(&key
, sizeof key
, 0);
329 /* Find existing stream or start a new one for a SYN or if there's data. */
330 stream
= tcp_stream_lookup(r
, &key
, hash
);
332 if (flags
& TCP_SYN
|| l7_length
) {
333 stream
= tcp_stream_new(r
, &key
, hash
);
334 stream
->seq_no
= flags
& TCP_SYN
? seq
+ 1 : seq
;
340 payload
= &stream
->payload
;
341 if (flags
& TCP_SYN
|| !stream
->seq_no
) {
342 dp_packet_clear(payload
);
343 stream
->seq_no
= seq
+ 1;
345 } else if (flags
& (TCP_FIN
| TCP_RST
)) {
346 tcp_stream_destroy(r
, stream
);
348 } else if (seq
== stream
->seq_no
) {
349 /* Shift all of the existing payload to the very beginning of the
350 * allocated space, so that we reuse allocated space instead of
351 * continually expanding it. */
352 dp_packet_shift(payload
, (char *) dp_packet_base(payload
) - (char *) dp_packet_data(payload
));
354 dp_packet_put(payload
, l7
, l7_length
);
355 stream
->seq_no
+= l7_length
;